CVE-2023-25950

HTTP request/response smuggling vulnerability in HAProxy version 2.7.0, and 2.6.1 to 2.6.7 allows a remote attacker to alter a legitimate user's request. As a result, the attacker may obtain sensitive information or cause a denial-of-service (DoS) condition.

CVSS v3 7.3 HIGH

7.3^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://git.haproxy.org/?p=haproxy-2.7.git%3Ba=commit%3Bh=3ca4223c5e1f18a19dc93b0b09ffdbd295554d46
https://jvn.jp/en/jp/JVN38170084/	Third Party Advisory VDB Entry
https://www.haproxy.org/	Product

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:haproxy:haproxy::::::::
	cpe:2.3:a:haproxy:haproxy:2.7.0:::::::*

History

07 Nov 2023, 04:09

Type	Values Removed	Values Added
References	{'url': 'https://git.haproxy.org/?p=haproxy-2.7.git;a=commit;h=3ca4223c5e1f18a19dc93b0b09ffdbd295554d46', 'name': 'https://git.haproxy.org/?p=haproxy-2.7.git;a=commit;h=3ca4223c5e1f18a19dc93b0b09ffdbd295554d46', 'tags': ['Mailing List', 'Patch'], 'refsource': 'MISC'}	() https://git.haproxy.org/?p=haproxy-2.7.git%3Ba=commit%3Bh=3ca4223c5e1f18a19dc93b0b09ffdbd295554d46 -

Information

Published : 2023-04-11 09:15

Updated : 2024-02-28 20:13

NVD link : CVE-2023-25950

Mitre link : CVE-2023-25950

CVE.ORG link : CVE-2023-25950

JSON object : View

Products Affected

haproxy

haproxy

CWE

CWE-444

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

7.3 /10